halfcycle 0.4.18 → 0.5.1

package/dist/index.js

@@ -115,6 +115,7 @@ ${block}`);
 
 // ../core/dist/hook-wiring.js
 var SETTINGS_REL = ".claude/settings.json";
+var LOCAL_SETTINGS_REL = ".claude/settings.local.json";
 var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
 var PRE_FILTER_SHELL_FILENAME = "pre-tool-use-filter.sh";
 var PRE_FILTER_FUNCTION = "halfcycle_pt_skip";
@@ -280,6 +281,7 @@ var HOOK_REMEDY = `Run ${SIGN_IN_COMMAND} in the project folder to sign in.`;
 import { z as z2 } from "zod";
 var TASK_PLAN_TASKS_MAX = 500;
 var TASK_PLAN_ID_MAX = 64;
+var TASK_PLAN_BUILDS_NONE = "none";
 var TASK_PLAN_KINDS = ["build", "review", "spec", "walk", "check"];
 var CONTROL_CHARACTER = /[\u0000-\u001f\u007f-\u009f]/;
 var planText = z2.string().refine((text) => !CONTROL_CHARACTER.test(text), { message: "holds a control character" });
@@ -295,7 +297,8 @@ var taskPlanTaskSchema = z2.object({
     interfaces: z2.array(planText).optional()
   }).strict().optional(),
   wholeProject: z2.literal(true).optional(),
-  ships: z2.enum(["deploy", "release"]).optional()
+  ships: z2.enum(["deploy", "release"]).optional(),
+  builds: z2.union([z2.literal(TASK_PLAN_BUILDS_NONE), z2.array(planText)]).optional()
 }).strict().superRefine((task, ctx) => {
   if (task.reviews !== void 0 && task.kind !== "review") {
     ctx.addIssue({
@@ -332,6 +335,101 @@ var taskListFileSchema = z2.union([
   z2.array(z2.unknown())
 ]);
 
+// ../core/dist/agent-profile.js
+var AGENT_IDS = ["claude-code", "codex"];
+var CLAUDE_CODE_PROFILE = {
+  id: "claude-code",
+  settingsFiles: [SETTINGS_REL, LOCAL_SETTINGS_REL],
+  wiring: HALFCYCLE_HOOK_WIRING,
+  commands: HALFCYCLE_HOOK_COMMANDS,
+  wiringPaths: HALFCYCLE_HOOK_WIRING_PATHS,
+  writeCapableTools: WRITE_CAPABLE_TOOLS,
+  projectRoot: "claude-project-dir",
+  configFolder: "claude-config",
+  mcpRegistration: { file: MCP_REGISTRATION_REL, serversKey: "mcpServers", serverKey: MCP_SERVER_KEY },
+  tierModels: {
+    deep: { model: "opus" },
+    standard: { model: "sonnet" },
+    fast: { model: "haiku" }
+  }
+};
+var CODEX_HOOKS_REL = ".codex/hooks.json";
+var CODEX_CONFIG_REL = ".codex/config.toml";
+function codexHookCommand(script, args) {
+  const invocation = `cd "$(git rev-parse --show-toplevel)" && bash ./${script}`;
+  return args === void 0 ? invocation : `${invocation} ${args}`;
+}
+var CODEX_WINDOWS_NOT_SET_UP = "Halfcycle checks did not run because Halfcycle is not set up in this folder or any folder above it; run npx halfcycle in the project folder.";
+var CODEX_WINDOWS_NO_GIT_BASH = "Halfcycle checks did not run because Git for Windows was not found; install Git for Windows, then open a new session.";
+function codexHookCommandWindows(script, args) {
+  const tick = (text) => "`" + text + "`";
+  const argv = [script, ...args === void 0 ? [] : args.split(" ")].map(tick).join(",");
+  const program = [
+    "const p=require(`path`),f=require(`fs`),c=require(`child_process`);",
+    "let d=process.cwd();",
+    `for(;;){if(f.existsSync(p.join(d,${tick(VENDORED_BIN_REL)})))break;`,
+    "const u=p.dirname(d);",
+    "if(u===d){d=``;break}",
+    "d=u}",
+    `if(d===\`\`){console.error(${tick(CODEX_WINDOWS_NOT_SET_UP)})}else{`,
+    "const g=c.spawnSync(`git`,[`--exec-path`],{encoding:`utf8`});",
+    "const b=g.status===0?p.join(g.stdout.trim(),`..`,`..`,`..`,`bin`,`bash.exe`):``;",
+    `if(b===\`\`||!f.existsSync(b)){console.error(${tick(CODEX_WINDOWS_NO_GIT_BASH)})}else{`,
+    `const r=c.spawnSync(b,[${argv}],{cwd:d,stdio:\`inherit\`});`,
+    "process.exitCode=typeof r.status===`number`?r.status:1}}"
+  ].join("");
+  return `node -e '${program}'`;
+}
+function codexHookRow(event, matcher, timeout, script, args) {
+  return {
+    event,
+    matcher,
+    timeout,
+    command: codexHookCommand(script, args),
+    script,
+    commandWindows: codexHookCommandWindows(script, args)
+  };
+}
+var CODEX_WRITE_CAPABLE_TOOLS = ["apply_patch", "Edit", "Write"];
+var CODEX_PRE_TOOL_USE_MATCHER = "^(Bash|apply_patch)$";
+var CODEX_HOOK_WIRING = [
+  codexHookRow("SessionStart", null, 5, SESSION_START_MARKER_REL),
+  codexHookRow("SessionStart", null, 10, GUARD_RUNNER_REL, "refresh-credential --agent codex"),
+  codexHookRow("UserPromptSubmit", null, 5, USER_PROMPT_REMINDER_REL),
+  codexHookRow("UserPromptSubmit", null, 10, USER_PROMPT_SCOPE_REL, "--agent codex"),
+  codexHookRow("UserPromptSubmit", null, 10, USER_PROMPT_FINDINGS_REL, "--agent codex"),
+  codexHookRow("PreToolUse", CODEX_PRE_TOOL_USE_MATCHER, 10, GUARD_RUNNER_REL, "hook pre-tool-use --agent codex"),
+  codexHookRow("PostToolUse", CODEX_WRITE_CAPABLE_TOOLS.join("|"), 60, GUARD_RUNNER_REL, "hook post-tool-use --agent codex"),
+  codexHookRow("Stop", null, 60, GUARD_RUNNER_REL, "hook stop --agent codex"),
+  codexHookRow("SubagentStop", null, 60, GUARD_RUNNER_REL, "hook subagent-stop --agent codex"),
+  codexHookRow("SessionEnd", null, 3, SESSION_END_MARKER_REL)
+];
+var RETIRED_CODEX_HOOK_COMMANDS = [];
+function codexHookCommandSet(retired) {
+  return /* @__PURE__ */ new Set([...CODEX_HOOK_WIRING.map((entry) => entry.command), ...retired]);
+}
+var CODEX_PROFILE = {
+  id: "codex",
+  settingsFiles: [CODEX_HOOKS_REL],
+  wiring: CODEX_HOOK_WIRING,
+  commands: codexHookCommandSet(RETIRED_CODEX_HOOK_COMMANDS),
+  wiringPaths: [.../* @__PURE__ */ new Set([CODEX_HOOKS_REL, ...CODEX_HOOK_WIRING.map((entry) => entry.script), VENDORED_BIN_REL])],
+  writeCapableTools: CODEX_WRITE_CAPABLE_TOOLS,
+  projectRoot: "git-toplevel",
+  configFolder: "codex-home",
+  mcpRegistration: { file: CODEX_CONFIG_REL, serversKey: "mcp_servers", serverKey: MCP_SERVER_KEY },
+  tierModels: {
+    deep: { model: "gpt-6-luna", effort: "high" },
+    standard: { model: "gpt-6-luna", effort: "medium" },
+    fast: { model: "gpt-6-luna", effort: "low" }
+  }
+};
+var AGENT_PROFILES = {
+  "claude-code": CLAUDE_CODE_PROFILE,
+  codex: CODEX_PROFILE
+};
+var ALL_HOOK_COMMANDS = new Set(AGENT_IDS.flatMap((id) => [...AGENT_PROFILES[id].commands]));
+
 // ../events/dist/result.js
 import { z as z3 } from "zod";
 var firedGuardSchema = z3.object({
@@ -1195,7 +1293,10 @@ var buildSnapshotReportResultSchema = z8.object({
   // Which phase the graph was recorded against.
   phase: buildPhaseSchema,
   // When it was recorded.
-  reportedAt: utcIso8601
+  reportedAt: utcIso8601,
+  // One sentence to pass on to the developer about the graph just stored. Absent
+  // when there is nothing to say.
+  warning: z8.string().min(1).max(400).optional()
 }).strict();
 
 // ../events/dist/phase-plan.js
@@ -3632,7 +3733,14 @@ function serializeManifest(manifest) {
     files: [...manifest.files].sort((a, b) => byString(a.path, b.path)),
     createdDirs: [...manifest.createdDirs].sort(byString),
     leftAlone: [...manifest.leftAlone].sort(byString),
-    settings
+    settings,
+    ...manifest.codexHooks !== void 0 ? {
+      codexHooks: {
+        ...manifest.codexHooks,
+        hookCommands: [...manifest.codexHooks.hookCommands].sort(byString),
+        eventsCreated: [...manifest.codexHooks.eventsCreated].sort(byString)
+      }
+    } : {}
   };
   return JSON.stringify(canonicalJson(ordered), null, 2) + "\n";
 }
@@ -3686,7 +3794,7 @@ function parseManifest(text) {
   }
   if (!isRecord(raw))
     throw new UnreadableManifestError("it is not a JSON object");
-  onlyKeys(raw, ["format", "files", "createdDirs", "leftAlone", "settings", "mcp", "gitignore", "gitattributes"], "the manifest");
+  onlyKeys(raw, ["format", "files", "createdDirs", "leftAlone", "settings", "mcp", "codexHooks", "codexConfig", "gitignore", "gitattributes"], "the manifest");
   if (raw["format"] !== INSTALL_MANIFEST_FORMAT) {
     throw new UnreadableManifestError(`its format is not ${INSTALL_MANIFEST_FORMAT}`);
   }
@@ -3752,6 +3860,30 @@ function parseManifest(text) {
       ...typeof m["entrySha256"] === "string" ? { entrySha256: m["entrySha256"] } : {}
     };
   }
+  let codexHooks;
+  if (raw["codexHooks"] !== void 0) {
+    const c = raw["codexHooks"];
+    if (!isRecord(c))
+      throw new UnreadableManifestError('"codexHooks" is not an object');
+    onlyKeys(c, ["created", "adopted", "hookCommands", "eventsCreated", "hooksCreated"], '"codexHooks"');
+    codexHooks = {
+      created: bool(c["created"], "codexHooks.created"),
+      adopted: bool(c["adopted"], "codexHooks.adopted"),
+      hookCommands: stringArray(c["hookCommands"], "codexHooks.hookCommands"),
+      eventsCreated: stringArray(c["eventsCreated"], "codexHooks.eventsCreated"),
+      hooksCreated: bool(c["hooksCreated"], "codexHooks.hooksCreated")
+    };
+  }
+  let codexConfig;
+  if (raw["codexConfig"] !== void 0) {
+    const c = raw["codexConfig"];
+    if (!isRecord(c))
+      throw new UnreadableManifestError('"codexConfig" is not an object');
+    onlyKeys(c, ["created", "block"], '"codexConfig"');
+    if (typeof c["block"] !== "string")
+      throw new UnreadableManifestError('"codexConfig.block" is not a string');
+    codexConfig = { created: bool(c["created"], "codexConfig.created"), block: c["block"] };
+  }
   if (raw["gitignore"] === void 0)
     throw new UnreadableManifestError('"gitignore" is missing');
   const gitignore = appendedTextRecord(raw["gitignore"], "gitignore");
@@ -3770,6 +3902,8 @@ function parseManifest(text) {
     leftAlone,
     settings,
     ...mcp !== void 0 ? { mcp } : {},
+    ...codexHooks !== void 0 ? { codexHooks } : {},
+    ...codexConfig !== void 0 ? { codexConfig } : {},
     gitignore,
     ...gitattributes !== void 0 ? { gitattributes } : {}
   };
@@ -3787,6 +3921,8 @@ function startManifest(previous, isMember, isMemberDir) {
     createdDirs: new Set((previous?.createdDirs ?? []).filter(isMemberDir)),
     settings: previous?.settings,
     mcp: previous?.mcp,
+    codexHooks: previous?.codexHooks,
+    codexConfig: previous?.codexConfig,
     gitignore: previous?.gitignore,
     gitattributes: previous?.gitattributes
   };
@@ -3847,6 +3983,19 @@ function recordMcp(draft, observed) {
     ...entrySha256 !== void 0 ? { entrySha256 } : {}
   };
 }
+function recordCodexHooks(draft, observed) {
+  const prev = draft.codexHooks;
+  draft.codexHooks = prev === void 0 ? observed : {
+    created: prev.created,
+    adopted: prev.adopted,
+    hookCommands: union(prev.hookCommands, observed.hookCommands),
+    eventsCreated: union(prev.eventsCreated, observed.eventsCreated),
+    hooksCreated: prev.hooksCreated
+  };
+}
+function recordCodexConfig(draft, observed) {
+  draft.codexConfig = { created: draft.codexConfig?.created ?? observed.created, block: observed.block };
+}
 function recordGitignore(draft, created, appended) {
   draft.gitignore = carryAppended(draft.gitignore, created, appended);
 }
@@ -3880,6 +4029,8 @@ function finishManifest(draft) {
       denyCreated: false
     },
     ...draft.mcp !== void 0 ? { mcp: draft.mcp } : {},
+    ...draft.codexHooks !== void 0 ? { codexHooks: draft.codexHooks } : {},
+    ...draft.codexConfig !== void 0 ? { codexConfig: draft.codexConfig } : {},
     gitignore: draft.gitignore ?? { created: false, appended: [] },
     ...draft.gitattributes !== void 0 ? { gitattributes: draft.gitattributes } : {}
   };
@@ -4025,6 +4176,30 @@ var PREVIEW_WORDS = Object.freeze({
     change: "takes out an older Halfcycle sign-in; your own lines stay as they are",
     leave: "an older Halfcycle sign-in that cannot be moved yet; left as it is",
     yours: YOURS
+  },
+  "codex-checks": {
+    add: "Codex's checks, the same ones Halfcycle runs for Claude Code",
+    change: "adds the checks Halfcycle needs; your own entries stay as they are",
+    leave: "already has the checks Halfcycle needs",
+    yours: YOURS
+  },
+  "codex-server": {
+    add: "tells Codex how to reach Halfcycle's service",
+    change: "adds Halfcycle's entry; your own entries stay as they are",
+    leave: "already has Halfcycle's entry",
+    yours: YOURS
+  },
+  skill: {
+    add: "a skill your coding agent can run to take the next Halfcycle step",
+    change: "a newer version of this Halfcycle skill",
+    leave: SAME,
+    yours: YOURS
+  },
+  "crew-profile": {
+    add: "a member of your build crew, so your coding agent shows who is working",
+    change: "a newer version of this build-crew member",
+    leave: SAME,
+    yours: YOURS
   }
 });
 var kindTable;
@@ -4049,13 +4224,21 @@ function kinds() {
     [RETIRED_MCP_HEADERS_HELPER_REL, "halfcycle-folder"],
     [LEGACY_CI_STANZA_REL, "halfcycle-folder"],
     [CAPTURED_INDEX_REL, "captured-index"],
-    [LEGACY_ENV_LOCAL_REL, "old-sign-in"]
+    [LEGACY_ENV_LOCAL_REL, "old-sign-in"],
+    [CODEX_HOOKS_REL2, "codex-checks"],
+    [CODEX_CONFIG_REL2, "codex-server"]
   ]);
   return kindTable;
 }
 function previewKindOf(rel) {
   if (/^\.claude\/commands\/[^/]+\.md$/.test(rel))
     return "command";
+  if (/^\.agents\/skills\/[^/]+\/SKILL\.md$/.test(rel))
+    return "skill";
+  if (/^\.claude\/agents\/[^/]+\.md$/.test(rel))
+    return "crew-profile";
+  if (/^\.codex\/agents\/[^/]+\.toml$/.test(rel))
+    return "crew-profile";
   return kinds().get(rel);
 }
 function kindOf(rel) {
@@ -4081,6 +4264,7 @@ function planInstall(options) {
   const previous = readPreviousManifest(targetRepo);
   const dirsBefore = new Set([...writeSet.dirs].filter((dir) => existsSync3(join5(targetRepo, dir))));
   const { version, commands } = planCommandStubs(targetRepo, previous, writeSet);
+  const codexSkills = planCodexSkills(targetRepo, previous, writeSet);
   const vendored = planVendoredBinary(targetRepo);
   let settings;
   try {
@@ -4094,6 +4278,8 @@ function planInstall(options) {
   const ciStanza = planLegacyCiStanzaRemoval(targetRepo);
   const mcp = planMcpRegistration(targetRepo, preview ? "pending" : credential);
   const mcpHelper = mcp.kind === "none" ? null : planMcpHeadersHelperRemoval(targetRepo);
+  const codexHooks = planCodexHooks(targetRepo);
+  const codexConfig = planCodexConfig(targetRepo, preview ? "pending" : credential);
   const gitignore = planGitignore(targetRepo);
   const gitattributes = planGitattributes(targetRepo);
   const identity = planProjectIdentity(targetRepo);
@@ -4105,6 +4291,7 @@ function planInstall(options) {
   const legacy = migrateLegacyEnvLocal(targetRepo, storedAfter);
   const pin = preview ? planBundlePinPreview(targetRepo, version, home) : planBundlePin(targetRepo, version, engagementId, engagementType, createdByAccountId, credential?.methodVersion);
   const crew = planCrewRoster(targetRepo);
+  const crewProfiles = planCrewProfiles(targetRepo, previous, writeSet);
   const scan = { text: planBootstrapScan(targetRepo).text };
   const steps = {
     targetRepo,
@@ -4117,12 +4304,15 @@ function planInstall(options) {
     previous,
     dirsBefore,
     commands,
+    codexSkills,
     vendored,
     settings,
     hooks,
     ciStanza,
     mcp,
     mcpHelper,
+    codexHooks,
+    codexConfig,
     gitignore,
     gitattributes,
     identity,
@@ -4130,6 +4320,7 @@ function planInstall(options) {
     legacy,
     pin,
     crew,
+    crewProfiles,
     scan
   };
   const record2 = preview ? null : planInstallRecord(targetRepo, accountInstall(steps, predicted(steps)).manifestText);
@@ -4155,16 +4346,24 @@ function predicted(steps) {
       lands(planned.rel, planned.text, planned.outcome === "written");
   };
   steps.commands.forEach(file);
+  steps.codexSkills.forEach(file);
   file(steps.vendored);
   file(steps.settings.file);
   steps.hooks.forEach(file);
   if (steps.mcp.kind === "write")
     lands(MCP_REGISTRATION_REL, steps.mcp.text, steps.mcp.outcome !== "skipped");
+  if (steps.codexHooks.outcome === "written" && steps.codexHooks.text !== null) {
+    lands(CODEX_HOOKS_REL2, steps.codexHooks.text, true);
+  }
+  if (steps.codexConfig.outcome === "written" && steps.codexConfig.text !== null) {
+    lands(CODEX_CONFIG_REL2, steps.codexConfig.text, true);
+  }
   if (steps.identity.after !== null)
     lands(PROJECT_IDENTITY_REL, steps.identity.after, steps.identity.action === "add");
   if (steps.pin !== null)
     file(steps.pin);
   file(steps.crew);
+  steps.crewProfiles.forEach(file);
   if (steps.scan.text !== null)
     lands(BOOTSTRAP_STATE_REL, steps.scan.text, true);
   const mergeAfter = (planned) => planned.outcome === "written" ? planned.after : planned.before;
@@ -4222,6 +4421,7 @@ function entriesOf(steps, record2) {
     entries.push({ path: rel, action: there ? "change" : "add", kind: kindOf(rel), bytes: PENDING });
   };
   steps.commands.forEach(fromFile);
+  steps.codexSkills.forEach(fromFile);
   fromFile(steps.vendored);
   const settings = steps.settings;
   entries.push(settings.file.outcome === "written" ? { path: SETTINGS_REL, action: settings.preexisted ? "change" : "add", kind: "settings", bytes: settings.file.text } : { path: SETTINGS_REL, action: "leave", kind: "settings", bytes: null });
@@ -4237,6 +4437,38 @@ function entriesOf(steps, record2) {
     entries.push({ path: MCP_REGISTRATION_REL, action: "leave", kind: "server-entry", bytes: null });
   }
   retired(RETIRED_MCP_HEADERS_HELPER_REL, steps.mcpHelper);
+  const codexHooks = steps.codexHooks;
+  if (codexHooks.outcome === "written") {
+    entries.push({ path: CODEX_HOOKS_REL2, action: codexHooks.before === null ? "add" : "change", kind: "codex-checks", bytes: codexHooks.text });
+  } else if (codexHooks.outcome === "current") {
+    entries.push({ path: CODEX_HOOKS_REL2, action: "leave", kind: "codex-checks", bytes: null });
+  } else {
+    entries.push({ path: CODEX_HOOKS_REL2, action: "leave", kind: "codex-checks", bytes: null, yours: true });
+  }
+  const codexConfig = steps.codexConfig;
+  switch (codexConfig.outcome) {
+    case "written":
+      entries.push({ path: CODEX_CONFIG_REL2, action: codexConfig.before === null ? "add" : "change", kind: "codex-server", bytes: codexConfig.text });
+      break;
+    case "pending":
+      pending(CODEX_CONFIG_REL2);
+      break;
+    case "current":
+    case "no-credential":
+      entries.push({ path: CODEX_CONFIG_REL2, action: "leave", kind: "codex-server", bytes: null });
+      break;
+    case "conflict":
+    case "link":
+    case "refused-address":
+      entries.push({
+        path: CODEX_CONFIG_REL2,
+        action: "leave",
+        kind: "codex-server",
+        bytes: null,
+        ...existsSync3(join5(targetRepo, CODEX_CONFIG_REL2)) ? { yours: true } : {}
+      });
+      break;
+  }
   merge(GITIGNORE_REL, steps.gitignore);
   merge(GITATTRIBUTES_REL, steps.gitattributes);
   const identity = steps.identity;
@@ -4259,6 +4491,7 @@ function entriesOf(steps, record2) {
   else
     fromFile(steps.pin);
   fromFile(steps.crew);
+  steps.crewProfiles.forEach(fromFile);
   entries.push(steps.scan.text !== null ? { path: BOOTSTRAP_STATE_REL, action: "add", kind: "halfcycle-folder", bytes: steps.scan.text } : { path: BOOTSTRAP_STATE_REL, action: "leave", kind: "halfcycle-folder", bytes: null });
   if (record2 === null)
     pending(INSTALL_MANIFEST_REL);
@@ -4299,6 +4532,8 @@ function applyInstallPlan(plan) {
   }
   for (const command of steps.commands)
     putPlannedFile(targetRepo, command);
+  for (const skill of steps.codexSkills)
+    putPlannedFile(targetRepo, skill);
   putPlannedFile(targetRepo, steps.vendored);
   putPlannedFile(targetRepo, steps.settings.file);
   for (const hook of steps.hooks)
@@ -4306,6 +4541,8 @@ function applyInstallPlan(plan) {
   const ciStanza = steps.ciStanza === "removed" ? removePlannedRetiredFile(targetRepo, LEGACY_CI_STANZA_REL) : steps.ciStanza;
   putPlannedMcp(targetRepo, steps.mcp);
   const mcpHelper = steps.mcpHelper === "removed" ? removePlannedRetiredFile(targetRepo, RETIRED_MCP_HEADERS_HELPER_REL) : steps.mcpHelper;
+  putPlannedCodexHooks(targetRepo, steps.codexHooks);
+  putPlannedCodexConfig(targetRepo, steps.codexConfig);
   const gitignore = putPlannedGitignore(targetRepo, steps.gitignore);
   const gitignorePath = join5(targetRepo, GITIGNORE_REL);
   const gitignoreAfter = existsSync3(gitignorePath) ? readFileSync4(gitignorePath, "utf-8") : null;
@@ -4318,6 +4555,8 @@ function applyInstallPlan(plan) {
   const legacy = applyLegacyMigration(targetRepo, migrateLegacyEnvLocal(targetRepo, stored));
   writeBundlePin(targetRepo, pin, []);
   putPlannedFile(targetRepo, steps.crew);
+  for (const profile of steps.crewProfiles)
+    putPlannedFile(targetRepo, profile);
   if (steps.scan.text !== null)
     writeBootstrapState(targetRepo, steps.scan.text);
   const { report, installManifest, manifestText } = accountInstall(steps, {
@@ -4347,9 +4586,15 @@ function applyInstallPlan(plan) {
     replacedPaths: report.replacedPaths,
     bootstrapScanRan: steps.scan.text !== null,
     legacyCredentialKept: legacy.outcome === "kept" ? { keys: legacy.unbacked, missing: legacy.missingForAdoption } : null,
-    notShared
+    notShared,
+    codex: { hooks: steps.codexHooks.outcome, config: appliedCodexConfig(steps.codexConfig.outcome) }
   };
 }
+function appliedCodexConfig(outcome) {
+  if (outcome === "pending")
+    throw new Error("[halfcycle] a preview cannot be applied: it is still waiting for the service.");
+  return outcome;
+}
 
 // dist/mcp-endpoint.js
 var MCP_ENDPOINT_PATH = "/mcp";
@@ -4360,8 +4605,8 @@ function mcpEndpointUrl(origin) {
 // dist/node-floor.js
 var NODE_FLOOR_MAJOR = 18;
 var NODE_FLOOR_SENTENCE_HEAD = `Halfcycle needs Node ${NODE_FLOOR_MAJOR} or newer; you have `;
-function nodeFloorProgram(guarded) {
-  return `if(+process.versions.node.split('.')[0]<${NODE_FLOOR_MAJOR}){console.error('${NODE_FLOOR_SENTENCE_HEAD}'+process.versions.node);process.exitCode=1}else{${guarded}}`;
+function nodeFloorProgram(guarded, belowFloor = "process.exitCode=1") {
+  return `if(+process.versions.node.split('.')[0]<${NODE_FLOOR_MAJOR}){console.error('${NODE_FLOOR_SENTENCE_HEAD}'+process.versions.node);` + belowFloor + `}else{${guarded}}`;
 }
 
 // dist/merge-settings.js
@@ -4408,6 +4653,75 @@ function mergeSettings(existing, generated, retiredOurs, statusLine) {
   }
   return merged;
 }
+function isPlainRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function mergeCodexHooks(existing, generated, ours) {
+  const existingHooks = isPlainRecord(existing["hooks"]) ? existing["hooks"] : {};
+  const events = [
+    ...Object.keys(existingHooks),
+    ...Object.keys(generated.hooks).filter((event) => !(event in existingHooks))
+  ];
+  const mergedHooks = {};
+  for (const event of events) {
+    const rows = generated.hooks[event] ?? [];
+    const current = existingHooks[event];
+    if (current === void 0) {
+      mergedHooks[event] = rows.map(cloneGroup);
+      continue;
+    }
+    if (!Array.isArray(current)) {
+      mergedHooks[event] = current;
+      continue;
+    }
+    const wanted = new Map(rows.map((row) => [row.hooks[0].command, row]));
+    const placed = /* @__PURE__ */ new Set();
+    const next = [];
+    for (const group of current) {
+      if (!isPlainRecord(group) || !Array.isArray(group["hooks"]) || !isHalfcycleEntry({ hooks: group["hooks"] }, ours)) {
+        next.push(group);
+        continue;
+      }
+      const hooks = group["hooks"];
+      if (hooks.length === 1) {
+        const command = hooks[0].command;
+        const row = wanted.get(command);
+        if (row !== void 0 && !placed.has(command)) {
+          placed.add(command);
+          next.push(cloneGroup(row));
+        }
+        continue;
+      }
+      const kept = [];
+      for (const hook of hooks) {
+        if (!isHalfcycleCommand(hook, ours)) {
+          kept.push(hook);
+          continue;
+        }
+        const command = hook.command;
+        const row = wanted.get(command);
+        if (row !== void 0 && !placed.has(command) && group["matcher"] === row.matcher) {
+          placed.add(command);
+          kept.push({ ...row.hooks[0] });
+        }
+      }
+      if (kept.length > 0)
+        next.push({ ...group, hooks: kept });
+    }
+    for (const row of rows) {
+      if (!placed.has(row.hooks[0].command))
+        next.push(cloneGroup(row));
+    }
+    mergedHooks[event] = next;
+  }
+  return { ...existing, hooks: mergedHooks };
+}
+function cloneGroup(group) {
+  return {
+    ...group.matcher === void 0 ? {} : { matcher: group.matcher },
+    hooks: group.hooks.map((hook) => ({ ...hook }))
+  };
+}
 function mergePermissions(existing, generated, retiredOurs) {
   if (existing === void 0 && generated === void 0)
     return void 0;
@@ -4430,8 +4744,261 @@ function mergePermissions(existing, generated, retiredOurs) {
   return result;
 }
 
+// dist/toml-lines.js
+var BARE_KEY_CHAR = /[A-Za-z0-9_-]/;
+var Unreadable = class extends Error {
+};
+function skipBlank(line, i) {
+  while (i < line.length && (line[i] === " " || line[i] === "	"))
+    i += 1;
+  return i;
+}
+function readKey(line, start) {
+  const segments = [];
+  let i = start;
+  for (; ; ) {
+    i = skipBlank(line, i);
+    const c = line[i];
+    if (c === '"') {
+      const close = line.indexOf('"', i + 1);
+      if (close < 0)
+        throw new Unreadable();
+      const segment = line.slice(i + 1, close);
+      if (segment.includes("\\"))
+        throw new Unreadable();
+      segments.push(segment);
+      i = close + 1;
+    } else if (c === "'") {
+      const close = line.indexOf("'", i + 1);
+      if (close < 0)
+        throw new Unreadable();
+      segments.push(line.slice(i + 1, close));
+      i = close + 1;
+    } else {
+      let j = i;
+      while (j < line.length && BARE_KEY_CHAR.test(line[j]))
+        j += 1;
+      if (j === i)
+        throw new Unreadable();
+      segments.push(line.slice(i, j));
+      i = j;
+    }
+    i = skipBlank(line, i);
+    if (line[i] !== ".")
+      return { segments, end: i };
+    i += 1;
+  }
+}
+function readValue(line, start, state) {
+  let i = start;
+  while (i < line.length) {
+    if (state.multiline !== null) {
+      const delimiter = state.multiline;
+      const escapes = delimiter === '"""';
+      while (i < line.length) {
+        if (escapes && line[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        if (line.startsWith(delimiter, i)) {
+          i += 3;
+          let extra = 0;
+          while (extra < 2 && line[i] === delimiter[0]) {
+            i += 1;
+            extra += 1;
+          }
+          state.multiline = null;
+          break;
+        }
+        i += 1;
+      }
+      continue;
+    }
+    const c = line[i];
+    if (c === "#")
+      return;
+    if (c === '"' || c === "'") {
+      const triple = c.repeat(3);
+      if (line.startsWith(triple, i)) {
+        state.multiline = triple;
+        i += 3;
+        continue;
+      }
+      let j = i + 1;
+      for (; ; ) {
+        if (j >= line.length)
+          throw new Unreadable();
+        if (c === '"' && line[j] === "\\") {
+          j += 2;
+          continue;
+        }
+        if (line[j] === c)
+          break;
+        j += 1;
+      }
+      i = j + 1;
+      continue;
+    }
+    if (c === "[" || c === "{")
+      state.depth += 1;
+    else if (c === "]" || c === "}") {
+      state.depth -= 1;
+      if (state.depth < 0)
+        throw new Unreadable();
+    }
+    i += 1;
+  }
+}
+function scanTomlStatements(lines, skip) {
+  const statements = [];
+  const state = { multiline: null, depth: 0 };
+  let table = [];
+  let index = 0;
+  try {
+    for (index = 0; index < lines.length; index += 1) {
+      const inValue = state.multiline !== null || state.depth > 0;
+      if (skip !== void 0 && index === skip.from) {
+        if (inValue)
+          throw new Unreadable();
+        table = skip.tableAfter;
+        index = skip.to;
+        continue;
+      }
+      let line = lines[index];
+      if (index === 0 && line.startsWith("\uFEFF"))
+        line = line.slice(1);
+      if (inValue) {
+        readValue(line, 0, state);
+        continue;
+      }
+      let i = skipBlank(line, 0);
+      if (i >= line.length || line[i] === "#")
+        continue;
+      if (line[i] === "[") {
+        const array = line[i + 1] === "[";
+        i += array ? 2 : 1;
+        const key2 = readKey(line, i);
+        i = key2.end;
+        if (line[i] !== "]" || array && line[i + 1] !== "]")
+          throw new Unreadable();
+        i = skipBlank(line, i + (array ? 2 : 1));
+        if (i < line.length && line[i] !== "#")
+          throw new Unreadable();
+        table = key2.segments;
+        statements.push({ line: index, kind: array ? "array-table" : "table", path: key2.segments });
+        continue;
+      }
+      const key = readKey(line, i);
+      if (line[key.end] !== "=")
+        throw new Unreadable();
+      statements.push({ line: index, kind: "key", path: [...table, ...key.segments] });
+      readValue(line, key.end + 1, state);
+    }
+    if (state.multiline !== null || state.depth > 0) {
+      index = lines.length - 1;
+      throw new Unreadable();
+    }
+  } catch (err) {
+    if (err instanceof Unreadable)
+      return { ok: false, line: index };
+    throw err;
+  }
+  return { ok: true, statements };
+}
+
 // dist/install.js
 var ZONE_B_DIR = ".workbench";
+var CODEX_HOOKS_REL2 = AGENT_PROFILES.codex.settingsFiles[0];
+var CODEX_CONFIG_REL2 = AGENT_PROFILES.codex.mcpRegistration.file;
+var CLAUDE_AGENTS_DIR = ".claude/agents";
+var CODEX_AGENTS_DIR = ".codex/agents";
+var CREW_CALLSIGN_PATTERN = /^[A-Z][A-Z0-9]*$/;
+function crewProfileRel(agent, callsign) {
+  if (!CREW_CALLSIGN_PATTERN.test(callsign)) {
+    throw new Error(`[halfcycle] crew callsign "${callsign}" is not a valid profile name (must match ^[A-Z][A-Z0-9]*$).`);
+  }
+  return agent === "claude-code" ? `${CLAUDE_AGENTS_DIR}/${callsign}.md` : `${CODEX_AGENTS_DIR}/${callsign.toLowerCase()}.toml`;
+}
+function crewProfileTarget(targetRepo, rel) {
+  const folder = rel.startsWith(`${CLAUDE_AGENTS_DIR}/`) ? CLAUDE_AGENTS_DIR : CODEX_AGENTS_DIR;
+  const target = resolve(join6(targetRepo, rel));
+  if (dirname3(target) !== resolve(targetRepo, folder)) {
+    throw new Error(`[halfcycle] crew profile "${rel}" does not sit directly in ${folder}.`);
+  }
+  return target;
+}
+var CREW_ROLE_WORDS = {
+  "business-analyst": "business analyst",
+  architect: "architect",
+  "spec-writer": "spec writer",
+  builder: "builder",
+  "context-docs": "context and docs writer",
+  "spec-reviewer": "spec reviewer",
+  "code-test-reviewer": "code and test reviewer",
+  "delivery-lead": "delivery lead",
+  "quality-lead": "quality lead"
+};
+var CREW_TIER_WORDS = {
+  deep: "You think carefully and deeply before you act, and take the time the work needs.",
+  standard: "You think each step through at a steady pace before you act.",
+  fast: "You work quickly on clear, well-defined work, and say so when a task needs more thought."
+};
+var CREW_REVIEWER_WORDS = "You check the work you are given and never change it: you read it, run what you need to, and report what you find.";
+var CREW_REVIEWER_TOOLS = "Read, Grep, Glob, Bash";
+var CREW_MEMBER_TOOLS = "Read, Edit, Write, Bash, Grep, Glob";
+function crewProfileBody(role, group, tier) {
+  const lines = [`You are a ${CREW_ROLE_WORDS[role]} on this project's build crew.`, CREW_TIER_WORDS[tier]];
+  if (group === "reviewer")
+    lines.push(CREW_REVIEWER_WORDS);
+  return `${lines.join("\n")}
+`;
+}
+function crewProfileDescription(member) {
+  return `${member.callsign}, ${CREW_ROLE_WORDS[member.role]} (${member.discipline}), a member of this project's build crew.`;
+}
+function plainYamlValue(value) {
+  if (/[\r\n]|: | #|^[-?:,[\]{}#&*!|>'"%@`\s]|\s$/.test(value)) {
+    throw new Error(`[halfcycle] a crew profile value cannot be written as plain text: ${JSON.stringify(value)}`);
+  }
+  return value;
+}
+function claudeCrewProfile(member) {
+  const tools = member.group === "reviewer" ? CREW_REVIEWER_TOOLS : CREW_MEMBER_TOOLS;
+  return [
+    "---",
+    `name: ${plainYamlValue(member.callsign)}`,
+    `description: ${plainYamlValue(crewProfileDescription(member))}`,
+    `model: ${plainYamlValue(AGENT_PROFILES["claude-code"].tierModels[member.tier].model)}`,
+    `tools: ${tools}`,
+    "---",
+    "",
+    crewProfileBody(member.role, member.group, member.tier)
+  ].join("\n");
+}
+function codexCrewProfile(member) {
+  const { model, effort } = AGENT_PROFILES.codex.tierModels[member.tier];
+  if (effort === void 0)
+    throw new Error(`[halfcycle] Codex's ${member.tier} tier names no reasoning effort.`);
+  const body = crewProfileBody(member.role, member.group, member.tier);
+  if (/[\\"]|[\u0000-\u0009\u000b-\u001f\u007f]/.test(body)) {
+    throw new Error("[halfcycle] a crew profile body holds a character a Codex role cannot carry as written.");
+  }
+  return [
+    `name = ${tomlBasicString(member.callsign.toLowerCase())}`,
+    `description = ${tomlBasicString(crewProfileDescription(member))}`,
+    `model = ${tomlBasicString(model)}`,
+    `model_reasoning_effort = ${tomlBasicString(effort)}`,
+    `developer_instructions = """`,
+    `${body}"""`,
+    ""
+  ].join("\n");
+}
+function renderCrewProfiles(roster = CREW_ROSTER) {
+  return [
+    ...roster.map((member) => ({ rel: crewProfileRel("claude-code", member.callsign), text: claudeCrewProfile(member) })),
+    ...roster.filter((member) => member.group !== "reviewer").map((member) => ({ rel: crewProfileRel("codex", member.callsign), text: codexCrewProfile(member) }))
+  ];
+}
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = dirname3(__filename);
 function findBundleRoot(startDir) {
@@ -4483,13 +5050,23 @@ var WRITE_ALLOWLIST = [
   "test/fixtures/captured",
   MCP_REGISTRATION_REL,
   ".gitattributes",
-  ZONE_B_DIR
+  ZONE_B_DIR,
+  // Codex's twin of '.claude/commands' (`codex-install-target` AC4, T-14): one
+  // `.agents/skills/<name>/SKILL.md` per command, same collision rule.
+  ".agents/skills",
+  // Codex's checks file, merged beside a developer's own entries.
+  CODEX_HOOKS_REL2,
+  // Codex's settings file: one marked block is added, and the rest of the file is left as it is.
+  CODEX_CONFIG_REL2,
+  // Each crew member's own profile, by its exact name; no other file in those folders is written.
+  ...renderCrewProfiles().map((profile) => profile.rel)
 ];
+var CREW_PROFILE_RELS = new Set(renderCrewProfiles().map((p) => p.rel));
 function isAllowlisted(targetRelPath) {
   const normalised = targetRelPath.replace(/\\/g, "/");
   return WRITE_ALLOWLIST.some((prefix) => {
     const p = prefix.replace(/\\/g, "/");
-    return normalised === p || normalised.startsWith(p + "/");
+    return normalised === p || !CREW_PROFILE_RELS.has(p) && normalised.startsWith(p + "/");
   });
 }
 var CREW_ROSTER_REL = ".halfcycle/crew.json";
@@ -4502,6 +5079,12 @@ var GITATTRIBUTES_REL = ".gitattributes";
 function commandStubRel(name) {
   return `.claude/commands/${name}.md`;
 }
+function skillRel(name) {
+  if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+    throw new Error(`[halfcycle] plugin.json command "${name}" is not a valid skill name (must match ^[a-z][a-z0-9-]*$).`);
+  }
+  return `.agents/skills/${name}/SKILL.md`;
+}
 var RETIRED_MCP_HEADERS_HELPER_REL = ".halfcycle/mcp-headers.sh";
 var RETIRED_WRITE_SET_FILES = [RETIRED_MCP_HEADERS_HELPER_REL];
 var RETIRED_DENY_PATTERNS = [
@@ -4520,6 +5103,9 @@ function closedWriteSet() {
   const commands = readPluginManifest().commands ?? [];
   const files = /* @__PURE__ */ new Set([
     ...commands.map((cmd) => commandStubRel(cmd.name)),
+    // Codex's twin of the stubs (`codex-install-target` AC4, T-14), derived from the
+    // same manifest array the stubs come from — one closed-set source for both.
+    ...commands.map((cmd) => skillRel(cmd.name)),
     ...Object.keys(OWNED_GENERATED_HEADERS),
     VENDORED_BIN_REL,
     CREW_ROSTER_REL,
@@ -4528,9 +5114,12 @@ function closedWriteSet() {
     BOOTSTRAP_STATE_REL,
     CAPTURED_INDEX_REL,
     INSTALL_MANIFEST_REL,
+    // The crew profiles (`crew-agent-profiles` AC6), from the same generator the
+    // allowlist and the plan read, so uninstall's set and the writer's cannot differ.
+    ...renderCrewProfiles().map((profile) => profile.rel),
     ...RETIRED_WRITE_SET_FILES
   ]);
-  const merged = /* @__PURE__ */ new Set([SETTINGS_REL, MCP_REGISTRATION_REL, GITIGNORE_REL, GITATTRIBUTES_REL]);
+  const merged = /* @__PURE__ */ new Set([SETTINGS_REL, MCP_REGISTRATION_REL, CODEX_HOOKS_REL2, CODEX_CONFIG_REL2, GITIGNORE_REL, GITATTRIBUTES_REL]);
   const dirs = /* @__PURE__ */ new Set();
   for (const path of [...files, ...merged]) {
     for (let dir = posix2.dirname(path); dir !== "."; dir = posix2.dirname(dir))
@@ -4543,6 +5132,7 @@ function closedWriteSet() {
     dirs,
     ownedDirs,
     hookCommands: new Set(HALFCYCLE_HOOK_COMMANDS),
+    codexHookCommands: new Set(AGENT_PROFILES.codex.commands),
     denyRuleSha256: new Set([...DENY_PATTERNS, ...RETIRED_DENY_PATTERNS].map((rule) => sha256Hex(rule))),
     settingsSchema: SETTINGS_SCHEMA,
     gitignoreLines: /* @__PURE__ */ new Set([GITIGNORE_HEADER, ...REQUIRED_GITIGNORE_ENTRIES, LEGACY_ENV_LOCAL_REL]),
@@ -4560,10 +5150,17 @@ function sha256OfWhatThisVersionWrites(commands) {
     if (existsSync4(src))
       out.set(rel, fileSha256(readFileSync5(src)));
   };
-  for (const cmd of commands)
-    fromFile(commandStubRel(cmd.name), join6(BUNDLE_ROOT, ".claude-plugin", cmd.path));
+  for (const cmd of commands) {
+    const srcFile = join6(BUNDLE_ROOT, ".claude-plugin", cmd.path);
+    fromFile(commandStubRel(cmd.name), srcFile);
+    if (existsSync4(srcFile)) {
+      out.set(skillRel(cmd.name), fileSha256(Buffer.from(codexSkillContent(cmd.name, readFileSync5(srcFile, "utf-8")), "utf-8")));
+    }
+  }
   for (const [rel, content] of hookScriptsThisVersionWrites())
     out.set(rel, fileSha256(content));
+  for (const profile of renderCrewProfiles())
+    out.set(profile.rel, fileSha256(Buffer.from(profile.text, "utf-8")));
   fromFile(CAPTURED_INDEX_REL, capturedIndexScaffold());
   return out;
 }
@@ -4667,6 +5264,8 @@ function findNotShared(targetRepo, manifest, collidedPaths) {
   const merged = [
     SETTINGS_REL,
     ...manifest.mcp !== void 0 ? [MCP_REGISTRATION_REL] : [],
+    ...manifest.codexHooks !== void 0 ? [CODEX_HOOKS_REL2] : [],
+    ...manifest.codexConfig !== void 0 ? [CODEX_CONFIG_REL2] : [],
     ...manifest.gitignore.created || manifest.gitignore.appended.length > 0 ? [GITIGNORE_REL] : [],
     ...manifest.gitattributes !== void 0 && (manifest.gitattributes.created || manifest.gitattributes.appended.length > 0) ? [GITATTRIBUTES_REL] : []
   ];
@@ -4727,6 +5326,55 @@ function readPluginManifest() {
   const raw = readFileSync5(manifestPath, "utf-8");
   return JSON.parse(raw);
 }
+function parseCommandStub(raw, name) {
+  const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/.exec(raw);
+  if (match === null) {
+    throw new Error(`[halfcycle] commands/${name}.md has no frontmatter block; cannot build its Codex skill.`);
+  }
+  const [, frontmatter, body] = match;
+  const desc = /^description:\s*(.+)$/m.exec(frontmatter);
+  if (desc === null) {
+    throw new Error(`[halfcycle] commands/${name}.md's frontmatter has no description; cannot build its Codex skill.`);
+  }
+  return { description: desc[1].trim(), body };
+}
+var TRUST_SENTENCE_WORDS = "Claude Code does not trust this folder yet, open it there and accept the workspace-trust prompt";
+var CODEX_TRUST_SENTENCE = "Codex does not trust this folder yet, open it there and trust it when asked";
+function trustSentencePattern() {
+  const words = TRUST_SENTENCE_WORDS.split(" ").map((w) => w.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  return new RegExp(words.join("(?: |\\n> )"));
+}
+var MCP_RECONNECT_WORDS = "run `/mcp` and reconnect it";
+var CODEX_MCP_FALLBACK = "start a new Codex session";
+function mcpReconnectPattern() {
+  const words = MCP_RECONNECT_WORDS.split(" ").map((w) => w.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  return new RegExp(words.join("(?: |\\n> )"));
+}
+function codexSkillBody(name, sourceBody) {
+  const slashForm = "`/" + name + "`";
+  if (!sourceBody.includes(slashForm)) {
+    throw new Error(`[halfcycle] commands/${name}.md never names itself as ${slashForm}; cannot build its Codex skill.`);
+  }
+  const pattern = trustSentencePattern();
+  if (!pattern.test(sourceBody)) {
+    throw new Error(`[halfcycle] commands/${name}.md is missing the Claude Code trust sentence; cannot build its Codex skill.`);
+  }
+  const bareName = "`" + name + "`";
+  const transformed = sourceBody.split(slashForm).join(bareName).replace(trustSentencePattern(), CODEX_TRUST_SENTENCE).replace(mcpReconnectPattern(), CODEX_MCP_FALLBACK);
+  if (transformed.includes("/mcp")) {
+    throw new Error(`[halfcycle] commands/${name}.md's Codex skill still names /mcp; cannot build.`);
+  }
+  return transformed;
+}
+function codexSkillContent(name, sourceRaw) {
+  const { description, body } = parseCommandStub(sourceRaw, name);
+  const transformed = codexSkillBody(name, body);
+  return `---
+name: ${name}
+description: ${description}
+---
+${transformed}`;
+}
 function planManifestCommands(manifest, targetRepo, previous, writeSet) {
   const recordedFiles = new Map((previous?.files ?? []).filter((file) => writeSet.files.has(file.path)).map((file) => [file.path, file]));
   return (manifest.commands ?? []).map((cmd) => {
@@ -4892,6 +5540,16 @@ function generateSettingsJson() {
   };
   return JSON.stringify(settings, null, 2) + "\n";
 }
+function codexHooksValue() {
+  const hooks = {};
+  for (const { event, matcher, timeout, command, commandWindows } of AGENT_PROFILES.codex.wiring) {
+    (hooks[event] ??= []).push({
+      ...matcher === null ? {} : { matcher },
+      hooks: [{ type: "command", command, timeout, ...commandWindows === void 0 ? {} : { commandWindows } }]
+    });
+  }
+  return { hooks };
+}
 var GENERATED_GUARD_RUNNER_HEADER = "# Governance hook wrapper \u2014 generated by";
 function generateGuardRunnerWrapper(preFilter = resolvePreFilterShell()) {
   return `#!/usr/bin/env bash
@@ -4944,9 +5602,11 @@ ${preFilter.trimEnd()}
 # Before a tool runs, on a bash new enough for the cheap pass: read the call
 # once; when no risky action can be in it, answer here (the pass writes the
 # time line) and do not start Node. Otherwise hand the same input on below.
+# The pass is given the hook's own arguments, so it knows which coding agent's
+# input it reads, and hands on any agent's call it has no test for.
 if [ "$1" = hook ] && [ "$2" = pre-tool-use ] && [ "\${BASH_VERSINFO[0]:-0}" -ge 5 ]; then
   hc_input=$(cat 2>/dev/null) || IFS= read -r -d '' hc_input
-  ${PRE_FILTER_FUNCTION} && exit 0
+  ${PRE_FILTER_FUNCTION} "$@" && exit 0
   node -e "${nodeFloorProgram("")}" || {
     printf '%s' "$hc_input" | halfcycle_pre_tool_use_fallback
     exit 0
@@ -5186,7 +5846,7 @@ exit 0
 var GENERATED_USER_PROMPT_SCOPE_HEADER = "# Typed scope approval \u2014 generated by";
 function generateUserPromptScopeHook() {
   return `#!/usr/bin/env bash
-${GENERATED_USER_PROMPT_SCOPE_HEADER} the Halfcycle installer, now also for the close review.
+${GENERATED_USER_PROMPT_SCOPE_HEADER} the Halfcycle installer, now also for the close review and Codex.
 #
 # Lets the owner of this project approve a phase's scope, or send it back,
 # decide one part of a phase's close review, or turn builds running on their
@@ -5194,20 +5854,25 @@ ${GENERATED_USER_PROMPT_SCOPE_HEADER} the Halfcycle installer, now also for the
 # Code session: "approve <phase>", "send back <phase>: <note>", "accept
 # <phase>/<part>", "question <phase>/<part>: <words>", "carry <phase>/<part>:
 # <words>", "drop <phase>/<part>: <words>", "reject <phase>/<task>: <words>",
-# "autonomy on" or "autonomy off".
+# "autonomy on" or "autonomy off". Also lets the person who is typing let one
+# step Halfcycle paused run once, by typing "allow" as the whole prompt.
 #
 # AN ORDINARY PROMPT STARTS NOTHING. This script reads the hook input once and
 # looks only at the start of the prompt's value. Unless the prompt begins, after
 # any whitespace (typed, or escaped in the input), with "approve ", "send back ",
-# "accept ", "question ", "carry ", "drop ", "reject " or "autonomy ", in any case, it exits
-# 0 with no output, and Node never starts. A quote inside any other field arrives
+# "accept ", "question ", "carry ", "drop ", "reject " or "autonomy ", in any case,
+# or is "allow" and nothing else but whitespace, it exits 0 with no output, and
+# Node never starts. A quote inside any other field arrives
 # escaped, so no other field (the folder the session is in, for one) can read as
 # the start of the prompt.
 #
 # Otherwise it finds the project root from its own location, never from the
 # folder the session has moved to, and hands the same input to the guard
 # wrapper beside it. That decides whether the line counts and prints at most
-# one plain line. Nothing here ever blocks a prompt.
+# one line. Nothing here ever blocks a prompt. Any arguments this script was
+# given (a Codex row passes its agent's name) are handed on after the verb; in
+# Codex a typed line never counts, because Codex cannot tell a person's line
+# from one a program sent.
 #
 # FAILS OPEN up to that hand-over: any error before it exits 0 with no output.
 # After it, the wrapper's own exit stands.
@@ -5223,7 +5888,7 @@ IFS= read -r -d '' HC_INPUT || true
 # \\u escape, or as the UTF-8 bytes of a Unicode space. Compared byte for byte.
 HC_LEAD='[[:space:]]|\\\\[nrtf]|\\\\u(000[9a-d]|0020|00a0|1680|200[0-9a]|202[89f]|205f|3000|feff)'
 HC_LEAD="$HC_LEAD|"$'\\xc2\\xa0|\\xe1\\x9a\\x80|\\xe2\\x80[\\x80-\\x8a\\xa8\\xa9\\xaf]|\\xe2\\x81\\x9f|\\xe3\\x80\\x80|\\xef\\xbb\\xbf'
-if ! printf '%s' "$HC_INPUT" | LC_ALL=C grep -Eiq "\\"prompt\\"[[:space:]]*:[[:space:]]*\\"($HC_LEAD)*(approve|send back|accept|question|carry|drop|reject|autonomy) "; then
+if ! printf '%s' "$HC_INPUT" | LC_ALL=C grep -Eiq "\\"prompt\\"[[:space:]]*:[[:space:]]*\\"($HC_LEAD)*((approve|send back|accept|question|carry|drop|reject|autonomy) |allow($HC_LEAD)*\\")"; then
   exit 0
 fi
 
@@ -5233,16 +5898,17 @@ export CLAUDE_PROJECT_DIR="$HC_PROJECT_ROOT"
 
 trap - ERR
 set +e
-exec bash "$HC_PROJECT_ROOT/.claude/hooks/guard-runner.sh" hook user-prompt-submit <<<"$HC_INPUT"
+exec bash "$HC_PROJECT_ROOT/.claude/hooks/guard-runner.sh" hook user-prompt-submit <<<"$HC_INPUT" "$@"
 `;
 }
 var GENERATED_USER_PROMPT_FINDINGS_HEADER = "# Findings hand-over \u2014 generated by";
 function generateUserPromptFindingsHook() {
   return `#!/usr/bin/env bash
-${GENERATED_USER_PROMPT_FINDINGS_HEADER} the Halfcycle installer.
+${GENERATED_USER_PROMPT_FINDINGS_HEADER} the Halfcycle installer, now also for Codex.
 #
 # At the person's next message, before the agent starts, hands it the details of
-# whatever Halfcycle's checks found at an earlier turn end, once.
+# whatever Halfcycle's checks found at an earlier turn end, once. Any arguments
+# this script was given (a Codex row passes its agent's name) are handed on.
 #
 # AN ORDINARY PROMPT STARTS NOTHING. With no findings file for this session, this
 # script reads its session id with a bash regex (no node) and exits 0 with no
@@ -5279,7 +5945,7 @@ export CLAUDE_PROJECT_DIR="$HC_PROJECT_ROOT"
 
 trap - ERR
 set +e
-exec bash "$HC_PROJECT_ROOT/.claude/hooks/guard-runner.sh" hook user-prompt-findings <<<"$HC_INPUT"
+exec bash "$HC_PROJECT_ROOT/.claude/hooks/guard-runner.sh" hook user-prompt-findings <<<"$HC_INPUT" "$@"
 `;
 }
 var CI_STANZA_KNOWN_HEADER_HASHES = [
@@ -5351,6 +6017,148 @@ var MCP_HEADERS_HELPER_COMMAND = `node -e "${nodeFloorProgram([
   `console.error('halfcycle: no ${VENDORED_BIN_REL} at or above '+process.cwd()+'; run npx halfcycle in the project folder');`,
   `process.exit(1)`
 ].join(""))}"`;
+var CODEX_ADDRESS_PATTERN = /^https?:\/\/[A-Za-z0-9.-]+(:[0-9]{1,5})?(\/[A-Za-z0-9._-]+)*\/mcp$/;
+function codexAddressAllowed(address) {
+  return CODEX_ADDRESS_PATTERN.test(address);
+}
+var CODEX_NO_CREDENTIAL_STATEMENT = `console.log(JSON.stringify({Authorization:'Bearer ${NO_CREDENTIAL_PLACEHOLDER}'}))`;
+function codexMcpHeadersHelperCommand(address) {
+  if (!codexAddressAllowed(address))
+    return null;
+  return `node -e "${nodeFloorProgram([
+    `let o=0;`,
+    `const n=function(){if(o)return;o=1;${CODEX_NO_CREDENTIAL_STATEMENT}};`,
+    `try{`,
+    `const p=require('path'),f=require('fs'),c=require('child_process');`,
+    `let d=process.cwd(),b='';`,
+    `for(;;){`,
+    `const t=p.join(d,'${VENDORED_BIN_REL}');`,
+    `if(f.existsSync(t)){b=t;break}`,
+    `const u=p.dirname(d);`,
+    `if(u===d)break;`,
+    `d=u}`,
+    `if(b===''){`,
+    `console.error('halfcycle: no ${VENDORED_BIN_REL} at or above '+process.cwd()+'; run npx halfcycle in the project folder');`,
+    `n()}else{`,
+    `const r=c.spawnSync(process.execPath,[b,'mcp-headers','--url','${address}'],{stdio:['ignore','pipe','inherit']});`,
+    `if(r.status===0&&r.stdout&&r.stdout.length){o=1;process.stdout.write(r.stdout)}else{n()}}`,
+    `}catch(e){n()}`
+  ].join(""), CODEX_NO_CREDENTIAL_STATEMENT)}"`;
+}
+var CODEX_CONFIG_OPEN_MARKER = "# >>> Halfcycle \u2014 generated by the Halfcycle installer; replaced on every install";
+var CODEX_CONFIG_CLOSE_MARKER = "# <<< Halfcycle";
+function tomlBasicString(value) {
+  if (/[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error("[halfcycle] a value for Codex's settings holds a control character.");
+  }
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function codexServerPath() {
+  const { serversKey, serverKey } = AGENT_PROFILES.codex.mcpRegistration;
+  return [serversKey, serverKey];
+}
+function generateCodexConfigBlock(address) {
+  return codexConfigBlockWith(address, codexMcpHeadersHelperCommand);
+}
+function codexConfigBlockWith(address, helperFor) {
+  if (!codexAddressAllowed(address))
+    return null;
+  const helper = helperFor(address);
+  if (helper === null)
+    return null;
+  const [serversKey, serverKey] = codexServerPath();
+  return [
+    CODEX_CONFIG_OPEN_MARKER,
+    `[${serversKey}.${serverKey}]`,
+    `url = ${tomlBasicString(address)}`,
+    `http_headers_helper = ${tomlBasicString(helper)}`,
+    CODEX_CONFIG_CLOSE_MARKER
+  ].join("\n");
+}
+function locateCodexBlock(lines) {
+  const opens = [];
+  const closes = [];
+  for (const [index, line] of lines.entries()) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("# >>> Halfcycle")) {
+      if (line !== CODEX_CONFIG_OPEN_MARKER)
+        return { kind: "broken" };
+      opens.push(index);
+    } else if (trimmed.startsWith("# <<< Halfcycle")) {
+      if (line !== CODEX_CONFIG_CLOSE_MARKER)
+        return { kind: "broken" };
+      closes.push(index);
+    }
+  }
+  if (opens.length === 0 && closes.length === 0)
+    return { kind: "none" };
+  if (opens.length === 1 && closes.length === 1 && opens[0] < closes[0]) {
+    return { kind: "one", open: opens[0], close: closes[0] };
+  }
+  return { kind: "broken" };
+}
+function definesCodexServer(statement, servers, server) {
+  const [first, second] = statement.path;
+  if (first !== servers)
+    return false;
+  if (statement.kind === "table")
+    return second === server;
+  return statement.path.length === 1 || second === server;
+}
+function linesOf(text) {
+  return text.split("\n").map((line) => line.endsWith("\r") ? line.slice(0, -1) : line);
+}
+function codexConfigConflict(existing) {
+  const lines = linesOf(existing);
+  const at = locateCodexBlock(lines);
+  if (at.kind === "broken")
+    return "broken-markers";
+  const [servers, server] = codexServerPath();
+  const scan = scanTomlStatements(lines, at.kind === "one" ? { from: at.open, to: at.close, tableAfter: [servers, server] } : void 0);
+  if (!scan.ok)
+    return "unreadable";
+  return scan.statements.some((statement) => definesCodexServer(statement, servers, server)) ? "server-named" : null;
+}
+function holdsCodexBlock(existing) {
+  return locateCodexBlock(linesOf(existing)).kind === "one";
+}
+function codexBlockSpan(text) {
+  const at = locateCodexBlock(linesOf(text));
+  if (at.kind !== "one")
+    return at.kind;
+  const raw = text.split("\n");
+  let start = 0;
+  for (let i = 0; i < at.open; i += 1)
+    start += raw[i].length + 1;
+  let end = start;
+  for (let i = at.open; i <= at.close; i += 1)
+    end += raw[i].length + 1;
+  return { start, end: Math.min(end, text.length) };
+}
+function reconcileCodexConfig(existing, block) {
+  if (existing === null || existing === "") {
+    const text2 = `${block}
+`;
+    return { kind: "new", text: text2, appended: existing === null ? null : text2, block: text2 };
+  }
+  const conflict = codexConfigConflict(existing);
+  if (conflict !== null)
+    return { kind: "conflict", reason: conflict };
+  const eol = lineEndingOf(existing);
+  const blockText = block.split("\n").join(eol);
+  const span = codexBlockSpan(existing);
+  if (span === "broken")
+    return { kind: "conflict", reason: "broken-markers" };
+  if (span === "none") {
+    const appended = `${existing.endsWith("\n") ? "" : eol}${eol}${blockText}${eol}`;
+    return { kind: "new", text: existing + appended, appended, block: `${blockText}${eol}` };
+  }
+  const old = existing.slice(span.start, span.end);
+  const ending = old.endsWith("\r\n") ? "\r\n" : old.endsWith("\n") ? "\n" : "";
+  const inFile = `${blockText}${ending}`;
+  const text = existing.slice(0, span.start) + inFile + existing.slice(span.end);
+  return text === existing ? { kind: "unchanged", block: inFile } : { kind: "new", text, appended: null, block: inFile };
+}
 var MCP_HEADERS_KNOWN_HEADER_HASHES = [
   "37a733ea588b3361b2bbfd86c44e0c95da30d7af6acffd1243ece83c811f0af2",
   "6732ec6d2d2bf7cb33017749a3d021b59af653dcd07c3811693b5a242d44b1a1"
@@ -5738,6 +6546,21 @@ function planCommandStubs(targetRepo, previous, writeSet) {
   const manifest = readPluginManifest();
   return { version: manifest.version, commands: planManifestCommands(manifest, targetRepo, previous, writeSet) };
 }
+function planCodexSkills(targetRepo, previous, writeSet) {
+  const manifest = readPluginManifest();
+  const recordedFiles = new Map((previous?.files ?? []).filter((file) => writeSet.files.has(file.path)).map((file) => [file.path, file]));
+  return (manifest.commands ?? []).map((cmd) => {
+    const srcFile = join6(BUNDLE_ROOT, ".claude-plugin", cmd.path);
+    if (!existsSync4(srcFile)) {
+      throw new Error(`[halfcycle] plugin.json declares command "${cmd.name}" at "${cmd.path}", but no file exists there (${srcFile}). The manifest and commands/ must agree.`);
+    }
+    const rel = skillRel(cmd.name);
+    const content = codexSkillContent(cmd.name, readFileSync5(srcFile, "utf-8"));
+    const recorded = recordedFiles.get(rel);
+    const planned = decideCollisionSafe(join6(targetRepo, rel), targetRepo, content, (current) => bytesAreOurs(rel, current, recorded, writeSet));
+    return { ...planned, editedCollided: planned.outcome === "collided" && recorded !== void 0 };
+  });
+}
 function planVendoredBinary(targetRepo) {
   return decideOwned(join6(targetRepo, ".halfcycle", "bin", "bin.bundle.mjs"), targetRepo, readFileSync5(resolveVendoredBinary(), "utf-8"));
 }
@@ -5785,9 +6608,156 @@ function putPlannedMcp(targetRepo, planned) {
     return;
   writeAllowlisted(join6(targetRepo, MCP_REGISTRATION_REL), targetRepo, planned.text, []);
 }
+function fileInFolderPlace(root, rel) {
+  for (let dir = posix2.dirname(rel); dir !== "."; dir = posix2.dirname(dir)) {
+    const found = lstatOrNull(join6(root, dir));
+    if (found !== null && !found.isDirectory())
+      return true;
+  }
+  return false;
+}
+function symlinkOnPath(root, rel) {
+  let current = root;
+  for (const segment of rel.split("/")) {
+    current = join6(current, segment);
+    try {
+      if (lstatSync(current).isSymbolicLink())
+        return true;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function planCodexHooks(targetRepo) {
+  const generated = codexHooksValue();
+  const leave = (outcome, before2) => ({
+    outcome,
+    before: before2,
+    existing: null,
+    generated,
+    text: null
+  });
+  if (symlinkOnPath(targetRepo, CODEX_HOOKS_REL2))
+    return leave("link", null);
+  const folder = lstatOrNull(join6(targetRepo, posix2.dirname(CODEX_HOOKS_REL2)));
+  if (folder !== null && !folder.isDirectory())
+    return leave("unreadable", null);
+  const path = join6(targetRepo, CODEX_HOOKS_REL2);
+  let before = null;
+  if (lstatOrNull(path) !== null) {
+    try {
+      before = readFileSync5(path, "utf-8");
+    } catch {
+      return leave("unreadable", null);
+    }
+  }
+  let existing = {};
+  if (before !== null) {
+    let value;
+    try {
+      value = JSON.parse(before);
+    } catch {
+      return leave("unreadable", before);
+    }
+    if (!isPlainObject(value))
+      return leave("unreadable", before);
+    const hooks = value["hooks"];
+    if (hooks !== void 0 && !isPlainObject(hooks))
+      return leave("unreadable", before);
+    const ourEvents = Object.keys(generated.hooks);
+    if (hooks !== void 0 && ourEvents.some((event) => event in hooks && !Array.isArray(hooks[event]))) {
+      return leave("unreadable", before);
+    }
+    existing = value;
+  }
+  const merged = mergeCodexHooks(existing, generated, AGENT_PROFILES.codex.commands);
+  if (before !== null && JSON.stringify(merged) === JSON.stringify(existing)) {
+    return { outcome: "current", before, existing, generated, text: null };
+  }
+  const text = inLineEndingOf(before, JSON.stringify(merged, null, 2) + "\n");
+  return { outcome: "written", before, existing: before === null ? null : existing, generated, text };
+}
+function putPlannedCodexHooks(targetRepo, planned) {
+  if (planned.outcome !== "written" || planned.text === null)
+    return;
+  writeAllowlisted(join6(targetRepo, CODEX_HOOKS_REL2), targetRepo, planned.text, []);
+}
+function readCodexConfig(targetRepo) {
+  const folder = lstatOrNull(join6(targetRepo, posix2.dirname(CODEX_CONFIG_REL2)));
+  if (folder !== null && !folder.isDirectory())
+    return "unreadable";
+  const path = join6(targetRepo, CODEX_CONFIG_REL2);
+  const stat = lstatOrNull(path);
+  if (stat === null)
+    return { text: null };
+  if (!stat.isFile())
+    return "unreadable";
+  let bytes;
+  try {
+    bytes = readFileSync5(path);
+  } catch {
+    return "unreadable";
+  }
+  const text = bytes.toString("utf-8");
+  return Buffer.from(text, "utf-8").equals(bytes) ? { text } : "unreadable";
+}
+function planCodexConfig(targetRepo, credential) {
+  const plan = (outcome, extra = {}) => ({
+    outcome,
+    before: null,
+    text: null,
+    appended: null,
+    inFile: null,
+    conflict: null,
+    blockKept: false,
+    ...extra
+  });
+  if (credential === void 0)
+    return plan("no-credential");
+  if (symlinkOnPath(targetRepo, CODEX_CONFIG_REL2))
+    return plan("link");
+  const read = readCodexConfig(targetRepo);
+  if (read === "unreadable")
+    return plan("conflict", { conflict: "unreadable" });
+  const before = read.text;
+  if (credential === "pending") {
+    const conflict = before === null ? null : codexConfigConflict(before);
+    return conflict === null ? plan("pending", { before }) : plan("conflict", { before, conflict });
+  }
+  const block = generateCodexConfigBlock(mcpEndpointUrl(credential.mcpUrl));
+  if (block === null)
+    return plan("refused-address", { before, blockKept: before !== null && holdsCodexBlock(before) });
+  const reconciled = reconcileCodexConfig(before, block);
+  switch (reconciled.kind) {
+    case "conflict":
+      return plan("conflict", { before, conflict: reconciled.reason });
+    case "unchanged":
+      return plan("current", { before, inFile: reconciled.block });
+    case "new":
+      return plan("written", { before, text: reconciled.text, appended: reconciled.appended, inFile: reconciled.block });
+  }
+}
+function putPlannedCodexConfig(targetRepo, planned) {
+  if (planned.outcome !== "written" || planned.text === null)
+    return;
+  writeAllowlisted(join6(targetRepo, CODEX_CONFIG_REL2), targetRepo, planned.text, []);
+}
 function planCrewRoster(targetRepo) {
   return decideOwned(join6(targetRepo, CREW_ROSTER_REL), targetRepo, renderCrewRoster());
 }
+function planCrewProfiles(targetRepo, previous, writeSet) {
+  const recordedFiles = new Map((previous?.files ?? []).filter((file) => writeSet.files.has(file.path)).map((file) => [file.path, file]));
+  return renderCrewProfiles().map(({ rel, text }) => {
+    const target = crewProfileTarget(targetRepo, rel);
+    if (symlinkOnPath(targetRepo, rel) || fileInFolderPlace(targetRepo, rel)) {
+      return { rel, text, outcome: "collided", replacedExisting: false, editedCollided: false };
+    }
+    const recorded = recordedFiles.get(rel);
+    const planned = decideCollisionSafe(target, targetRepo, text, (current) => bytesAreOurs(rel, current, recorded, writeSet));
+    return { ...planned, editedCollided: planned.outcome === "collided" && recorded !== void 0 };
+  });
+}
 function planInstallRecord(targetRepo, text) {
   return decideOwned(join6(targetRepo, INSTALL_MANIFEST_REL), targetRepo, text);
 }
@@ -5811,6 +6781,12 @@ function accountInstall(steps, actual) {
       report.editedCollidedPaths.push(command.rel);
     noteFile(draft, command.rel, command.outcome, actual.bytesAfter);
   }
+  for (const skill of steps.codexSkills) {
+    recordOwnedGenerated(report, skill);
+    if (skill.editedCollided)
+      report.editedCollidedPaths.push(skill.rel);
+    noteFile(draft, skill.rel, skill.outcome, actual.bytesAfter);
+  }
   noteFile(draft, VENDORED_BIN_REL, recordOwnedGenerated(report, steps.vendored), actual.bytesAfter);
   const settings = steps.settings;
   recordSettingsMerge(draft, settings.existing, settings.generated, settings.preexisted, settings.merged);
@@ -5868,6 +6844,8 @@ function accountInstall(steps, actual) {
     if (mcp.existing !== null)
       recordMcpAdoptionOnly(draft, mcp.existing);
   }
+  recordCodexHooksStep(report, draft, steps.codexHooks);
+  recordCodexConfigStep(report, draft, steps.codexConfig);
   recordGitignoreReconcile(draft, steps.gitignore.before, actual.gitignoreAfter, writeSet);
   if (actual.gitignore === "failed") {
     report.skippedPaths.push(".gitignore (write failed \u2014 see credential refusal)");
@@ -5910,6 +6888,12 @@ function accountInstall(steps, actual) {
     report.writtenPaths.push(BUNDLE_PIN_REL);
   noteFile(draft, BUNDLE_PIN_REL, "written", actual.bytesAfter);
   noteFile(draft, CREW_ROSTER_REL, recordOwnedGenerated(report, steps.crew), actual.bytesAfter);
+  for (const profile of steps.crewProfiles) {
+    recordOwnedGenerated(report, profile);
+    if (profile.editedCollided)
+      report.editedCollidedPaths.push(profile.rel);
+    noteFile(draft, profile.rel, profile.outcome, actual.bytesAfter);
+  }
   if (actual.stateExistsAfter)
     recordPerMachineFile(draft, BOOTSTRAP_STATE_REL);
   for (const dir of writeSet.dirs) {
@@ -5920,9 +6904,78 @@ function accountInstall(steps, actual) {
   assertManifestInWriteSet(installManifest, writeSet);
   return { report, installManifest, manifestText: serializeManifest(installManifest) };
 }
+function recordCodexHooksStep(report, draft, planned) {
+  switch (planned.outcome) {
+    case "unreadable":
+      report.skippedPaths.push(`${CODEX_HOOKS_REL2} (left as it is \u2014 it could not be read, so Codex's checks were not added)`);
+      return;
+    case "link":
+      report.skippedPaths.push(`${CODEX_HOOKS_REL2} (left as it is \u2014 it is a link Halfcycle does not follow)`);
+      return;
+    case "written":
+      (planned.before === null ? report.writtenPaths : report.mergedPaths).push(CODEX_HOOKS_REL2);
+      break;
+    case "current":
+      report.skippedPaths.push(CODEX_HOOKS_REL2);
+      break;
+  }
+  const existingHooks = planned.existing !== null && isPlainObject(planned.existing["hooks"]) ? planned.existing["hooks"] : void 0;
+  const ours = AGENT_PROFILES.codex.commands;
+  const heldOurs = Object.values(existingHooks ?? {}).some((groups) => Array.isArray(groups) && groups.some((group) => isPlainObject(group) && Array.isArray(group["hooks"]) && isHalfcycleEntry({ hooks: group["hooks"] }, ours)));
+  recordCodexHooks(draft, {
+    created: planned.before === null,
+    adopted: draft.previous === null && heldOurs,
+    hookCommands: Object.values(planned.generated.hooks).flatMap((groups) => groups.flatMap((group) => group.hooks.map((h) => h.command))),
+    eventsCreated: Object.keys(planned.generated.hooks).filter((event) => !(existingHooks && event in existingHooks)),
+    hooksCreated: planned.existing === null || planned.existing["hooks"] === void 0
+  });
+}
+function recordCodexConfigStep(report, draft, planned) {
+  const prev = draft.codexConfig;
+  const separatorOf = (block) => {
+    const at = block.indexOf(CODEX_CONFIG_OPEN_MARKER);
+    return at > 0 ? block.slice(0, at) : "";
+  };
+  switch (planned.outcome) {
+    case "written": {
+      (planned.before === null ? report.writtenPaths : report.mergedPaths).push(CODEX_CONFIG_REL2);
+      const block = planned.appended !== null ? planned.appended : planned.before === null ? planned.text : `${prev === void 0 ? "" : separatorOf(prev.block)}${planned.inFile}`;
+      recordCodexConfig(draft, { created: planned.before === null, block });
+      return;
+    }
+    case "current":
+      report.skippedPaths.push(CODEX_CONFIG_REL2);
+      if (prev === void 0)
+        recordCodexConfig(draft, { created: false, block: planned.inFile });
+      return;
+    case "no-credential":
+      report.skippedPaths.push(`${CODEX_CONFIG_REL2} (no MCP origin \u2014 no credential supplied)`);
+      return;
+    case "link":
+      report.skippedPaths.push(`${CODEX_CONFIG_REL2} (left as it is \u2014 it is a link Halfcycle does not follow)`);
+      return;
+    case "conflict":
+      report.skippedPaths.push(planned.conflict === "server-named" ? `${CODEX_CONFIG_REL2} (left as it is \u2014 it already names a "halfcycle" server, so Halfcycle did not add its own)` : planned.conflict === "broken-markers" ? `${CODEX_CONFIG_REL2} (left as it is \u2014 the lines marking Halfcycle's part of it are incomplete or repeated)` : `${CODEX_CONFIG_REL2} (left as it is \u2014 it could not be read, so Halfcycle did not add its entry)`);
+      return;
+    case "refused-address":
+      report.skippedPaths.push(planned.blockKept ? `${CODEX_CONFIG_REL2} (left as it is \u2014 the Halfcycle address cannot be passed to Codex safely; Halfcycle's existing entry in it was kept unchanged)` : `${CODEX_CONFIG_REL2} (not written \u2014 the Halfcycle address cannot be passed to Codex safely)`);
+      return;
+    case "pending":
+      throw new Error("[halfcycle] a plan still waiting for the service cannot be applied or recorded.");
+  }
+}
 function recordInstallRecord(report, planned) {
   recordOwnedGenerated(report, planned);
 }
+var SELF_BUILD_GITIGNORE_REL = ".halfcycle/.gitignore";
+var SELF_BUILD_WRITE_SET = [
+  BUNDLE_PIN_REL,
+  VENDORED_BIN_REL,
+  SELF_BUILD_GITIGNORE_REL,
+  CREW_ROSTER_REL,
+  MCP_REGISTRATION_REL,
+  ...renderCrewProfiles().map((profile) => profile.rel)
+];
 
 // dist/control-origin.js
 var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";